Feature: `io_uring_register` with fd=-1

There are some `io_uring_register` opcodes which do not operate on an existing ring and require the first argument FD to be `-1`, eg. `IORING_REGISTER_SEND_MSG_RING`, `IORING_REGISTER_QUERY` and more.

All these "blind registration" opcodes can be seen in kernel source: https://github.com/torvalds/linux/blob/f4d0ec0aa20d49f09dc01d82894ce80d72de0560/io_uring/register.c#L981-L999
If `fd` is not `-1`, the syscall will immediately [fail with EINVAL](https://github.com/torvalds/linux/blob/f4d0ec0aa20d49f09dc01d82894ce80d72de0560/io_uring/register.c#L1015-L1016). Our current API takes an `impl AsFd` which guarantees the validity of fd, since `BorrowedFd` forbids itself to be `-1`. This means [`IoringRegisterOp::RegisterSendMsgRing`](https://docs.rs/rustix/1.1.4/rustix/io_uring/enum.IoringRegisterOp.html#variant.RegisterSendMsgRing) is actually unusable with our current APIs.